Exception contracts for Ada? Was: Re: Press Release - Ada 2012 Language Standard Approved by ISO

["Peter C. Chapin" <pcc482719@gmail.com>]

On 12/24/2012 06:13 AM, Yannick Duchêne (Hibou57) wrote:

> This one is fine, I see your point now.

Exception contracts are a huge, HUGE topic and one that shouldn't be 
treated too lightly. I can understand their attraction in a language 
that prides itself on its suitability for robust programming. However, 
if exception contracts are ever added to Ada I pray to the Ada gods (the 
ARG?) that it is only done after an extensive review has been made of 
the issues related to them in other languages. One only needs to search 
for the topic of exception specifications in C++ and Java to find a 
mountain of discussion on the subject. Consider:

+ Should exception contracts be enforced statically or dynamically?

+ Should exception contracts be enforced at all or only produce warnings 
or logs?

+ What about backward compatibility with the existing code base? We 
don't want to force people to decorate all code with exception contracts 
before it will compile again with Ada 2020 (or whatever). Do we?

+ Should exception contracts distinguish between "impossible" exceptions 
that shouldn't occur in a correct program (like Constraint_Error) and 
"normal" exceptions that pertain to environmental problems such as 
invalid input data?

+ How should exception contracts interact with generic code?

+ Should exception contracts be a part of a subprogram's type? Consider 
access to subprogram values and their usage.

+ How should exception contracts interact with other static analysis 
techniques? For example if a subprogram has a contract that says it 
might raise exception E, but if static analysis can prove that a 
particular usage will not actually raise E, does the programmer have to 
declare a contract on the calling subprogram about E? One objection I've 
heard about exception specifications in Java is that they require 
programmers to either specify (or handle) exceptions that "clearly" can 
never actually arise at that particular program point.

Now that Ada has preconditions the last point is particularly acute. The 
precondition on a procedure P might guarantee that a called subprogram 
won't raise an exception that it might nevertheless declare in its 
exception contract. It would be really unpleasant if the programmer had 
to also add an exception contract to P stating that it might raise an 
exception that the programmer knows the precondition will prevent!

This is just a sample of some of the issues involved in the subject. 
There are those who have answers for all of these issues. That's great. 
But again I sincerely hope that if exception contracts are ever 
seriously considered for Ada that the matter be given the deep 
consideration it deserves.

Peter